                          ::members (keys this)
                          ::this this
                          ::failure ex}))))
-    (if (decrypt-cookie-packet this)
+    (if-let [this (decrypt-cookie-packet this)]
       (let [{:keys [::shared/my-keys]} this
-            this (assoc-in this
-                           [::shared-secrets ::client-short<->server-short]
-                           (crypto/box-prepare
-                            (get-in this
-                                    [::server-security
-                                     ::server-short-term-pk])
-                            (.getSecretKey (::short-pair my-keys))))]
-        (log/info "Managed to decrypt the cookie!")
-        ;; Note that this supplies new state
-        ;; Though whether it should is debatable.
-        ;; After all...why would I put this into ::vouch?
-        (assoc this ::vouch (build-vouch this)))
+            ;; This is nil.
+            ;; Q: Do I have any use for it at all?
+            server-short (get-in this
+                                 [::server-security
+                                  ::server-short-term-pk])]
+        (log/debug "Managed to decrypt the cookie!")
+        (if server-short
+          (let [this (assoc-in this
+                               [::shared-secrets ::client-short<->server-short]
+                               (crypto/box-prepare
+                                server-short
+                                (.getSecretKey (::shared/short-pair my-keys))))]
+            (log/info "Managed to prepare shared short-term secret")
+            ;; Note that this supplies new state
+            ;; Though whether it should is debatable.
+            ;; After all...why would I put this into ::vouch?
+            (assoc this ::vouch (build-vouch this)))
+          (do
+            (log/error (str "Missing server-short-term-pk among\n"
+                            (keys (::server-security this))
+                            "\namong bigger-picture\n"
+                            (keys this)))
+            (assert server-short))))
       (throw (ex-info
               "Unable to decrypt server cookie"
               this)))


(s/def ::server-extension ::shared/extension)
(s/def ::server-long-term-pk ::shared/public-key)
(s/def ::server-cookie any?)  ; TODO: Needs a real spec
(s/def ::server-short-term-pk ::shared/public-key)
(s/def ::server-security (s/keys :req [::server-long-term-pk
                                       ;; Q: Is there a valid reason for this to live here?

      ;; TODO: If/when an exception is thrown here, it would be nice
      ;; to notify callers immediately
      (let [decrypted (crypto/open-after text 0 144 working-nonce shared)
            extracted (shared/decompose K/cookie (Unpooled/wrappedBuffer (byte-array decrypted)))
            server-short-term-pk (byte-array K/key-length)
            server-cookie (byte-array K/server-cookie-length)
            server-security (assoc (::server-security this)
                                   ::server-short-term-pk
                                   server-short-term-pk,
                                   ::server-cookie server-cookie)
            {:keys [::K/s' ::K/black-box]} extracted]
        (.readBytes s' server-short-term-pk)
        (.readBytes black-box server-cookie)
        (assoc this ::server-security server-security)))))

(defn decrypt-cookie-packet
